[PATCH 4.14 54/65] iio: adc: hx711: fix bug in sampling of data

2019-10-16 Thread Greg Kroah-Hartman
From: Andreas Klinger [ Upstream commit 4043ecfb5fc4355a090111e14faf7945ff0fdbd5 ] Fix bug in sampling function hx711_cycle() when interrupt occures while PD_SCK is high. If PD_SCK is high for at least 60 us power down mode of the sensor is entered which in turn leads to a wrong measurement.

[PATCH 4.14 64/65] x86/asm: Fix MWAITX C-state hint value

2019-10-16 Thread Greg Kroah-Hartman
From: Janakarajan Natarajan commit 454de1e7d970d6bc567686052329e4814842867c upstream. As per "AMD64 Architecture Programmer's Manual Volume 3: General-Purpose and System Instructions", MWAITX EAX[7:4]+1 specifies the optional hint of the optimized C-state. For C0 state, EAX[7:4] should be set

[PATCH 4.14 49/65] kernel/sysctl.c: do not override max_threads provided by userspace

2019-10-16 Thread Greg Kroah-Hartman
From: Michal Hocko commit b0f53dbc4bc4c371f38b14c391095a3bb8a0bb40 upstream. Partially revert 16db3d3f1170 ("kernel/sysctl.c: threads-max observe limits") because the patch is causing a regression to any workload which needs to override the auto-tuning of the limit provided by kernel.

[PATCH 4.14 03/65] USB: rio500: Remove Rio 500 kernel driver

2019-10-16 Thread Greg Kroah-Hartman
From: Bastien Nocera commit 015664d15270a112c2371d812f03f7c579b35a73 upstream. The Rio500 kernel driver has not been used by Rio500 owners since 2001 not long after the rio500 project added support for a user-space USB stack through the very first versions of usbdevfs and then libusb. Support

[PATCH 4.14 60/65] tracing/hwlat: Report total time spent in all NMIs during the sample

2019-10-16 Thread Greg Kroah-Hartman
From: Srivatsa S. Bhat (VMware) commit 98dc19c11470ee6048aba723d77079ad2cda8a52 upstream. nmi_total_ts is supposed to record the total time spent in *all* NMIs that occur on the given CPU during the (active portion of the) sampling window. However, the code seems to be overwriting this variable

[PATCH 4.14 55/65] btrfs: fix incorrect updating of log root tree

2019-10-16 Thread Greg Kroah-Hartman
From: Josef Bacik commit 4203e968947071586a98b5314fd7ffdea3b4f971 upstream. We've historically had reports of being unable to mount file systems because the tree log root couldn't be read. Usually this is the "parent transid failure", but could be any of the related errors, including "fsid

[PATCH 4.14 05/65] USB: yurex: fix NULL-derefs on disconnect

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit aafb00a977cf7d81821f7c9d12e04c558c22dc3c upstream. The driver was using its struct usb_interface pointer as an inverted disconnected flag, but was setting it to NULL without making sure all code paths that used it were done with it. Before commit ef61eb43ada6 ("USB:

[PATCH 4.14 45/65] perf inject jit: Fix JIT_CODE_MOVE filename

2019-10-16 Thread Greg Kroah-Hartman
From: Steve MacLean commit b59711e9b0d22fd47abfa00602fd8c365cdd3ab7 upstream. During perf inject --jit, JIT_CODE_MOVE records were injecting MMAP records with an incorrect filename. Specifically it was missing the ".so" suffix. Further the JIT_CODE_LOAD record were silently truncating the

[PATCH 4.19 14/81] xhci: Increase STS_SAVE timeout in xhci_suspend()

2019-10-16 Thread Greg Kroah-Hartman
From: Kai-Heng Feng commit ac343366846a445bb81f0a0e8f16abb8bd5d5d88 upstream. After commit f7fac17ca925 ("xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()"), ASMedia xHCI may fail to suspend. Although the algorithms are essentially the same, the old max timeout is (usec + usec

[PATCH 4.19 11/81] xhci: Fix USB 3.1 capability detection on early xHCI 1.1 spec based hosts

2019-10-16 Thread Greg Kroah-Hartman
From: Mathias Nyman commit 47f50d61076523e1a0d5a070062c2311320eeca8 upstream. Early xHCI 1.1 spec did not mention USB 3.1 capable hosts should set sbrn to 0x31, or that the minor revision is a two digit BCD containing minor and sub-minor numbers. This was later clarified in xHCI 1.2. Some USB

[PATCH 4.19 10/81] xhci: Check all endpoints for LPM timeout

2019-10-16 Thread Greg Kroah-Hartman
From: Jan Schmidt commit d500c63f80f2ea08ee300e57da5f2af1c13875f5 upstream. If an endpoint is encountered that returns USB3_LPM_DEVICE_INITIATED, keep checking further endpoints, as there might be periodic endpoints later that return USB3_LPM_DISABLED due to shorter service intervals. Without

[PATCH 4.19 13/81] xhci: Prevent deadlock when xhci adapter breaks during init

2019-10-16 Thread Greg Kroah-Hartman
From: Bill Kuzeja commit 8de66b0e6a56ff10dd00d2b0f2ae52e300178587 upstream. The system can hit a deadlock if an xhci adapter breaks while initializing. The deadlock is between two threads: thread 1 is tearing down the adapter and is stuck in usb_unlocked_disable_lpm waiting to lock the

[PATCH 4.19 48/81] iio: light: opt3001: fix mutex unlock race

2019-10-16 Thread Greg Kroah-Hartman
From: David Frey commit 82f3015635249a8c8c45bac303fd84905066f04f upstream. When an end-of-conversion interrupt is received after performing a single-shot reading of the light sensor, the driver was waking up the result ready queue before checking opt->ok_to_ignore_lock to determine if it should

[PATCH 4.19 35/81] USB: legousbtower: fix slab info leak at probe

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit 1d427be4a39defadda6dd8f4659bc17f7591740f upstream. Make sure to check for short transfers when retrieving the version information at probe to avoid leaking uninitialised slab data when logging it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Signed-off-by:

[PATCH 4.19 27/81] USB: serial: option: add Telit FN980 compositions

2019-10-16 Thread Greg Kroah-Hartman
From: Daniele Palmas commit 5eb3f4b87a0e7e949c976f32f296176a06d1a93b upstream. This patch adds the following Telit FN980 compositions: 0x1050: tty, adb, rmnet, tty, tty, tty, tty 0x1051: tty, adb, mbim, tty, tty, tty, tty 0x1052: rndis, tty, adb, tty, tty, tty, tty 0x1053: tty, adb, ecm, tty,

[PATCH 4.19 21/81] USB: usblp: fix runtime PM after driver unbind

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit 9a31535859bfd8d1c3ed391f5e9247cd87bb7909 upstream. Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter") USB drivers must always balance their runtime PM gets and puts, including when the driver has already been unbound from

[PATCH 4.19 33/81] usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}()

2019-10-16 Thread Greg Kroah-Hartman
From: Yoshihiro Shimoda commit 1aae1394294cb71c6aa0bc904a94a7f2f1e75936 upstream. The commit 97664a207bc2 ("usb: renesas_usbhs: shrink spin lock area") had added a usbhsg_pipe_disable() calling into __usbhsg_ep_set_halt_wedge() accidentally. But, this driver should not call the

[PATCH 4.19 17/81] USB: adutux: fix use-after-free on release

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit 123a0f125fa3d2104043697baa62899d9e549272 upstream. The driver was accessing its struct usb_device in its release() callback without holding a reference. This would lead to a use-after-free whenever the device was disconnected while the character device was still open.

[PATCH 4.19 20/81] USB: iowarrior: fix use-after-free after driver unbind

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit b5f8d46867ca233d773408ffbe691a8062ed718f upstream. Make sure to stop also the asynchronous write URBs on disconnect() to avoid use-after-free in the completion handler after driver unbind. Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") Cc: stable

[PATCH 4.19 53/81] CIFS: Gracefully handle QueryInfo errors during open

2019-10-16 Thread Greg Kroah-Hartman
From: Pavel Shilovsky commit 30573a82fb179420b8aac30a3a3595aa96a93156 upstream. Currently if the client identifies problems when processing metadata returned in CREATE response, the open handle is being leaked. This causes multiple problems like a file missing a lease break by that client which

[PATCH 4.19 29/81] USB: serial: fix runtime PM after driver unbind

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit d51bdb93ca7e71d7fb30a572c7b47ed0194bf3fe upstream. Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter") USB drivers must always balance their runtime PM gets and puts, including when the driver has already been unbound from

[PATCH 4.19 58/81] firmware: google: increment VPD key_len properly

2019-10-16 Thread Greg Kroah-Hartman
From: Brian Norris [ Upstream commit 442f1e746e8187b9deb1590176f6b0ff19686b11 ] Commit 4b708b7b1a2c ("firmware: google: check if size is valid when decoding VPD data") adds length checks, but the new vpd_decode_entry() function botched the logic -- it adds the key length twice, instead of

[PATCH 4.19 77/81] tracing: Get trace_array reference for available_tracers files

2019-10-16 Thread Greg Kroah-Hartman
From: Steven Rostedt (VMware) commit 194c2c74f5532e62c218adeb8e2b683119503907 upstream. As instances may have different tracers available, we need to look at the trace_array descriptor that shows the list of the available tracers for the instance. But there's a race between opening the file and

[PATCH 4.19 24/81] serial: uartlite: fix exit path null pointer

2019-10-16 Thread Greg Kroah-Hartman
From: Randy Dunlap commit a553add0846f355a28ed4e81134012e4a1e280c2 upstream. Call uart_unregister_driver() conditionally instead of unconditionally, only if it has been previously registered. This uses driver.state, just as the sh-sci.c driver does. Fixes this null pointer dereference in

[PATCH 4.19 23/81] USB: ldusb: fix NULL-derefs on driver unbind

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit 58ecf131e74620305175a7aa103f81350bb37570 upstream. The driver was using its struct usb_interface pointer as an inverted disconnected flag, but was setting it to NULL before making sure all completion handlers had run. This could lead to a NULL-pointer dereference in a

[PATCH 4.19 46/81] iio: adc: ad799x: fix probe error handling

2019-10-16 Thread Greg Kroah-Hartman
From: Marco Felsch commit c62dd44901cfff12acc5792bf3d2dec20bcaf392 upstream. Since commit 0f7ddcc1bff1 ("iio:adc:ad799x: Write default config on probe and reset alert status on probe") the error path is wrong since it leaves the vref regulator on. Fix this by disabling both regulators. Fixes:

[PATCH 4.19 04/81] USB: yurex: Dont retry on unexpected errors

2019-10-16 Thread Greg Kroah-Hartman
From: Alan Stern commit 32a0721c6620b77504916dac0cea8ad497c4878a upstream. According to Greg KH, it has been generally agreed that when a USB driver encounters an unknown error (or one it can't handle directly), it should just give up instead of going into a potentially infinite retry loop.

[PATCH 4.19 79/81] x86/asm: Fix MWAITX C-state hint value

2019-10-16 Thread Greg Kroah-Hartman
From: Janakarajan Natarajan commit 454de1e7d970d6bc567686052329e4814842867c upstream. As per "AMD64 Architecture Programmer's Manual Volume 3: General-Purpose and System Instructions", MWAITX EAX[7:4]+1 specifies the optional hint of the optimized C-state. For C0 state, EAX[7:4] should be set

[PATCH 5.3 011/112] usb: xhci: wait for CNR controller not ready bit in xhci resume

2019-10-16 Thread Greg Kroah-Hartman
From: Rick Tseng commit a70bcbc322837eda1ab5994d12db941dc9733a7d upstream. NVIDIA 3.1 xHCI card would lose power when moving power state into D3Cold. Thus we need to wait for CNR bit to clear in xhci resume, just as in xhci init. [Minor changes to comment and commit message -Mathias] Cc:

[PATCH 5.3 003/112] USB: yurex: Dont retry on unexpected errors

2019-10-16 Thread Greg Kroah-Hartman
From: Alan Stern commit 32a0721c6620b77504916dac0cea8ad497c4878a upstream. According to Greg KH, it has been generally agreed that when a USB driver encounters an unknown error (or one it can't handle directly), it should just give up instead of going into a potentially infinite retry loop.

[PATCH 5.3 001/112] panic: ensure preemption is disabled during panic()

2019-10-16 Thread Greg Kroah-Hartman
From: Will Deacon commit 20bb759a66be52cf4a9ddd17fddaf509e11490cd upstream. Calling 'panic()' on a kernel with CONFIG_PREEMPT=y can leave the calling CPU in an infinite loop, but with interrupts and preemption enabled. From this state, userspace can continue to be scheduled, despite the system

[PATCH 5.3 004/112] USB: yurex: fix NULL-derefs on disconnect

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit aafb00a977cf7d81821f7c9d12e04c558c22dc3c upstream. The driver was using its struct usb_interface pointer as an inverted disconnected flag, but was setting it to NULL without making sure all code paths that used it were done with it. Before commit ef61eb43ada6 ("USB:

[PATCH 5.3 013/112] xhci: Increase STS_SAVE timeout in xhci_suspend()

2019-10-16 Thread Greg Kroah-Hartman
From: Kai-Heng Feng commit ac343366846a445bb81f0a0e8f16abb8bd5d5d88 upstream. After commit f7fac17ca925 ("xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()"), ASMedia xHCI may fail to suspend. Although the algorithms are essentially the same, the old max timeout is (usec + usec

[PATCH 4.19 63/81] btrfs: fix incorrect updating of log root tree

2019-10-16 Thread Greg Kroah-Hartman
From: Josef Bacik commit 4203e968947071586a98b5314fd7ffdea3b4f971 upstream. We've historically had reports of being unable to mount file systems because the tree log root couldn't be read. Usually this is the "parent transid failure", but could be any of the related errors, including "fsid

[PATCH 4.19 75/81] tracing/hwlat: Dont ignore outer-loop duration when calculating max_latency

2019-10-16 Thread Greg Kroah-Hartman
From: Srivatsa S. Bhat (VMware) commit fc64e4ad80d4b72efce116f87b3174f0b7196f8e upstream. max_latency is intended to record the maximum ever observed hardware latency, which may occur in either part of the loop (inner/outer). So we need to also consider the outer-loop sample when updating

[PATCH 4.19 76/81] ftrace: Get a reference counter for the trace_array on filter files

2019-10-16 Thread Greg Kroah-Hartman
From: Steven Rostedt (VMware) commit 9ef16693aff8137faa21d16ffe65bb9832d24d71 upstream. The ftrace set_ftrace_filter and set_ftrace_notrace files are specific for an instance now. They need to take a reference to the instance otherwise there could be a race between accessing the files and

[PATCH 4.19 61/81] iio: adc: stm32-adc: fix a race when using several adcs with dma and irq

2019-10-16 Thread Greg Kroah-Hartman
From: Fabrice Gasnier [ Upstream commit dcb10920179ab74caf88a6f2afadecfc2743b910 ] End of conversion may be handled by using IRQ or DMA. There may be a race when two conversions complete at the same time on several ADCs. EOC can be read as 'set' for several ADCs, with: - an ADC configured to

[PATCH 5.3 049/112] Staging: fbtft: fix memory leak in fbtft_framebuffer_alloc

2019-10-16 Thread Greg Kroah-Hartman
From: Navid Emamdoost commit 5bdea6060618cfcf1459dca137e89aee038ac8b9 upstream. In fbtft_framebuffer_alloc the error handling path should take care of releasing frame buffer after it is allocated via framebuffer_alloc, too. Therefore, in two failure cases the goto destination is changed to

[PATCH 5.3 000/112] 5.3.7-stable review

2019-10-16 Thread Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.3.7 release. There are 112 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri 18 Oct 2019 09:43:41 PM UTC. Anything

[PATCH 5.3 008/112] xhci: Prevent device initiated U1/U2 link pm if exit latency is too long

2019-10-16 Thread Greg Kroah-Hartman
From: Mathias Nyman commit cd9d9491e835a845c1a98b8471f88d26285e0bb9 upstream. If host/hub initiated link pm is prevented by a driver flag we still must ensure that periodic endpoints have longer service intervals than link pm exit latency before allowing device initiated link pm. Fix this by

[PATCH 5.3 033/112] USB: dummy-hcd: fix power budget for SuperSpeed mode

2019-10-16 Thread Greg Kroah-Hartman
From: jacky@sony.com commit 2636d49b64671d3d90ecc4daf971b58df3956519 upstream. The power budget for SuperSpeed mode should be 900 mA according to USB specification, so set the power budget to 900mA for dummy_start_ss which is only used for SuperSpeed mode. If the max power consumption of

[PATCH 5.3 032/112] USB: microtek: fix info-leak at probe

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit 177238c3d47d54b2ed8f0da7a4290db492f4a057 upstream. Add missing bulk-in endpoint sanity check to prevent uninitialised stack data from being reported to the system log and used as endpoint addresses. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Reported-by:

[PATCH 5.3 050/112] staging: rtl8188eu: fix HighestRate check in odm_ARFBRefresh_8188E()

2019-10-16 Thread Greg Kroah-Hartman
From: Denis Efremov commit 22d67a01d8d89552b989c9651419824bb4111200 upstream. It's incorrect to compare HighestRate with 0x0b twice in the following manner "if (HighestRate > 0x0b) ... else if (HighestRate > 0x0b) ...". The "else if" branch is constantly false. The second comparision should be

[PATCH 5.3 041/112] USB: legousbtower: fix potential NULL-deref on disconnect

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit cd81e6fa8e033e7bcd59415b4a65672b4780030b upstream. The driver is using its struct usb_device pointer as an inverted disconnected flag, but was setting it to NULL before making sure all completion handlers had run. This could lead to a NULL-pointer dereference in a

[PATCH 5.3 029/112] USB: serial: option: add support for Cinterion CLS8 devices

2019-10-16 Thread Greg Kroah-Hartman
From: Reinhard Speyerer commit dfbac2f4da6a0c4a8f6b4d715a4077a7b8df53ad upstream. Add support for the serial ports of Cinterion CLS8 devices. T: Bus=01 Lev=03 Prnt=05 Port=01 Cnt=02 Dev#= 25 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e2d

[PATCH 5.3 028/112] USB: serial: option: add Telit FN980 compositions

2019-10-16 Thread Greg Kroah-Hartman
From: Daniele Palmas commit 5eb3f4b87a0e7e949c976f32f296176a06d1a93b upstream. This patch adds the following Telit FN980 compositions: 0x1050: tty, adb, rmnet, tty, tty, tty, tty 0x1051: tty, adb, mbim, tty, tty, tty, tty 0x1052: rndis, tty, adb, tty, tty, tty, tty 0x1053: tty, adb, ecm, tty,

[PATCH 5.3 065/112] efi/tpm: Only set efi_tpm_final_log_size after successful event log parsing

2019-10-16 Thread Greg Kroah-Hartman
From: Jerry Snitselaar commit e658c82be5561412c5e83b5e74e9da4830593f3e upstream. If __calc_tpm2_event_size() fails to parse an event it will return 0, resulting tpm2_calc_event_log_size() returning -1. Currently there is no check of this return value, and 'efi_tpm_final_log_size' can end up

[PATCH 5.3 056/112] iio: adc: stm32-adc: fix a race when using several adcs with dma and irq

2019-10-16 Thread Greg Kroah-Hartman
From: Fabrice Gasnier commit dcb10920179ab74caf88a6f2afadecfc2743b910 upstream. End of conversion may be handled by using IRQ or DMA. There may be a race when two conversions complete at the same time on several ADCs. EOC can be read as 'set' for several ADCs, with: - an ADC configured to use

[PATCH 5.3 051/112] staging: vt6655: Fix memory leak in vt6655_probe

2019-10-16 Thread Greg Kroah-Hartman
From: Navid Emamdoost commit 80b15db5e1e9c3300de299b2d43d1aafb593e6ac upstream. In vt6655_probe, if vnt_init() fails the cleanup code needs to be called like other error handling cases. The call to device_free_info() is added. Fixes: 67013f2c0e58 ("staging: vt6655: mac80211 conversion add main

[PATCH 5.3 069/112] blk-wbt: fix performance regression in wbt scale_up/scale_down

2019-10-16 Thread Greg Kroah-Hartman
From: Harshad Shirwadkar commit b84477d3ebb96294f87dc3161e53fa8fe22d9bfd upstream. scale_up wakes up waiters after scaling up. But after scaling max, it should not wake up more waiters as waiters will not have anything to do. This patch fixes this by making scale_up (and also scale_down) return

[PATCH 5.3 083/112] btrfs: relocation: fix use-after-free on dead relocation roots

2019-10-16 Thread Greg Kroah-Hartman
From: Qu Wenruo commit 1fac4a54374f7ef385938f3c6cf7649c0fe4f6cd upstream. [BUG] One user reported a reproducible KASAN report about use-after-free: BTRFS info (device sdi1): balance: start -dvrange=1256811659264..1256811659265 BTRFS info (device sdi1): relocating block group 1256811659264

[PATCH 5.3 072/112] CIFS: Force revalidate inode when dentry is stale

2019-10-16 Thread Greg Kroah-Hartman
From: Pavel Shilovsky commit c82e5ac7fe3570a269c0929bf7899f62048e7dbc upstream. Currently the client indicates that a dentry is stale when inode numbers or type types between a local inode and a remote file don't match. If this is the case attributes is not being copied from remote to local,

[PATCH 5.3 091/112] MIPS: elf_hwcap: Export userspace ASEs

2019-10-16 Thread Greg Kroah-Hartman
From: Jiaxun Yang commit 38dffe1e4dde1d3174fdce09d67370412843ebb5 upstream. A Golang developer reported MIPS hwcap isn't reflecting instructions that the processor actually supported so programs can't apply optimized code at runtime. Thus we export the ASEs that can be used in userspace

[PATCH 5.3 086/112] Btrfs: fix memory leak due to concurrent append writes with fiemap

2019-10-16 Thread Greg Kroah-Hartman
From: Filipe Manana commit c67d970f0ea8dcc423e112137d34334fa0abb8ec upstream. When we have a buffered write that starts at an offset greater than or equals to the file's size happening concurrently with a full ranged fiemap, we can end up leaking an extent state structure. Suppose we have a

[PATCH 5.3 103/112] tracing/hwlat: Report total time spent in all NMIs during the sample

2019-10-16 Thread Greg Kroah-Hartman
From: Srivatsa S. Bhat (VMware) commit 98dc19c11470ee6048aba723d77079ad2cda8a52 upstream. nmi_total_ts is supposed to record the total time spent in *all* NMIs that occur on the given CPU during the (active portion of the) sampling window. However, the code seems to be overwriting this variable

[PATCH 5.3 110/112] io_uring: only flush workqueues on fileset removal

2019-10-16 Thread Greg Kroah-Hartman
From: Jens Axboe commit 8a99734081775c012a4a6c442fdef0379fe52bdf upstream. We should not remove the workqueue, we just need to ensure that the workqueues are synced. The workqueues are torn down on ctx removal. Cc: sta...@vger.kernel.org Fixes: 6b06314c47e1 ("io_uring: add file set

[PATCH 5.3 107/112] hwmon: Fix HWMON_P_MIN_ALARM mask

2019-10-16 Thread Greg Kroah-Hartman
From: Nuno Sá commit 30945d31e5761436d9eba6b8cff468a5f7c9c266 upstream. Both HWMON_P_MIN_ALARM and HWMON_P_MAX_ALARM were using BIT(hwmon_power_max_alarm). Fixes: aa7f29b07c870 ("hwmon: Add support for power min, lcrit, min_alarm and lcrit_alarm") CC: Signed-off-by: Nuno Sá Link:

[PATCH 5.3 104/112] tracing/hwlat: Dont ignore outer-loop duration when calculating max_latency

2019-10-16 Thread Greg Kroah-Hartman
From: Srivatsa S. Bhat (VMware) commit fc64e4ad80d4b72efce116f87b3174f0b7196f8e upstream. max_latency is intended to record the maximum ever observed hardware latency, which may occur in either part of the loop (inner/outer). So we need to also consider the outer-loop sample when updating

[PATCH 5.3 106/112] tracing: Get trace_array reference for available_tracers files

2019-10-16 Thread Greg Kroah-Hartman
From: Steven Rostedt (VMware) commit 194c2c74f5532e62c218adeb8e2b683119503907 upstream. As instances may have different tracers available, we need to look at the trace_array descriptor that shows the list of the available tracers for the instance. But there's a race between opening the file and

[PATCH 5.3 077/112] mm/page_alloc.c: fix a crash in free_pages_prepare()

2019-10-16 Thread Greg Kroah-Hartman
From: Qian Cai commit 234fdce892f905cbc2674349a9eb4873e288e5b3 upstream. On architectures like s390, arch_free_page() could mark the page unused (set_page_unused()) and any access later would trigger a kernel panic. Fix it by moving arch_free_page() after all possible accessing calls.

Re: [PATCH v2] usercopy: Avoid soft lockups in test_check_nonzero_user()

2019-10-16 Thread Michael Ellerman
Christian Brauner writes: > On Wed, Oct 16, 2019 at 11:27:32PM +1100, Michael Ellerman wrote: >> On a machine with a 64K PAGE_SIZE, the nested for loops in >> test_check_nonzero_user() can lead to soft lockups, eg: >> >> watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [modprobe:611] >>

Re: [PATCH 5.3 112/112] ASoC: sgtl5000: add ADC mute control

2019-10-16 Thread Mark Brown
On Wed, Oct 16, 2019 at 02:51:44PM -0700, Greg Kroah-Hartman wrote: > From: Oleksandr Suvorov > > commit 694b14554d75f2a1ae111202e71860d58b434a21 upstream. > > This control mute/unmute the ADC input of SGTL5000 > using its CHIP_ANA_CTRL register. This seems like a new feature and not an

[PATCH 5.3 112/112] ASoC: sgtl5000: add ADC mute control

2019-10-16 Thread Greg Kroah-Hartman
From: Oleksandr Suvorov commit 694b14554d75f2a1ae111202e71860d58b434a21 upstream. This control mute/unmute the ADC input of SGTL5000 using its CHIP_ANA_CTRL register. Signed-off-by: Oleksandr Suvorov Reviewed-by: Marcel Ziswiler Reviewed-by: Igor Opaniuk Reviewed-by: Fabio Estevam Link:

[PATCH 5.3 108/112] mtd: rawnand: au1550nd: Fix au_read_buf16() prototype

2019-10-16 Thread Greg Kroah-Hartman
From: Paul Burton commit df8fed831cbcdce7b283b2d9c1aadadcf8940d05 upstream. Commit 7e534323c416 ("mtd: rawnand: Pass a nand_chip object to chip->read_xxx() hooks") modified the prototype of the struct nand_chip read_buf function pointer. In the au1550nd driver we have 2 implementations of

[PATCH 5.3 076/112] mm/z3fold.c: claim page in the beginning of free

2019-10-16 Thread Greg Kroah-Hartman
From: Vitaly Wool commit 5b6807de11445c05b537df8324f5d7ab1c2782f9 upstream. There's a really hard to reproduce race in z3fold between z3fold_free() and z3fold_reclaim_page(). z3fold_reclaim_page() can claim the page after z3fold_free() has checked if the page was claimed and z3fold_free() will

[PATCH 5.3 073/112] CIFS: Force reval dentry if LOOKUP_REVAL flag is set

2019-10-16 Thread Greg Kroah-Hartman
From: Pavel Shilovsky commit 0b3d0ef9840f7be202393ca9116b857f6f793715 upstream. Mark inode for force revalidation if LOOKUP_REVAL flag is set. This tells the client to actually send a QueryInfo request to the server to obtain the latest metadata in case a directory or a file were changed

[PATCH 5.3 030/112] USB: serial: fix runtime PM after driver unbind

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit d51bdb93ca7e71d7fb30a572c7b47ed0194bf3fe upstream. Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter") USB drivers must always balance their runtime PM gets and puts, including when the driver has already been unbound from

[PATCH 5.3 066/112] perf llvm: Dont access out-of-scope array

2019-10-16 Thread Greg Kroah-Hartman
From: Ian Rogers commit 7d4c85b7035eb2f9ab217ce649dcd1bfaf0cacd3 upstream. The 'test_dir' variable is assigned to the 'release' array which is out-of-scope 3 lines later. Extend the scope of the 'release' array so that an out-of-scope array isn't accessed. Bug detected by clang's address

[PATCH 5.3 021/112] USB: usblp: fix runtime PM after driver unbind

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit 9a31535859bfd8d1c3ed391f5e9247cd87bb7909 upstream. Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter") USB drivers must always balance their runtime PM gets and puts, including when the driver has already been unbound from

[PATCH 5.3 055/112] iio: adc: stm32-adc: move registers definitions

2019-10-16 Thread Greg Kroah-Hartman
From: Fabrice Gasnier commit 31922f62bb527d749b99dbc776e514bcba29b7fe upstream. Move STM32 ADC registers definitions to common header. This is precursor patch to: - iio: adc: stm32-adc: fix a race when using several adcs with dma and irq It keeps registers definitions as a whole block, to ease

[PATCH 5.3 097/112] drm/i915: Bump skl+ max plane width to 5k for linear/x-tiled

2019-10-16 Thread Greg Kroah-Hartman
From: Ville Syrjälä commit dc7890995e04bacb45ab21e0daaeae1e7c803eb3 upstream. The officially validated plane width limit is 4k on skl+, however we already had people using 5k displays before we started to enforce the limit. Also it seems Windows allows 5k resolutions as well (though not sure if

[PATCH 5.3 084/112] btrfs: allocate new inode in NOFS context

2019-10-16 Thread Greg Kroah-Hartman
From: Josef Bacik commit 11a19a90870ea5496a8ded69b86f5b476b6d3355 upstream. A user reported a lockdep splat == WARNING: possible circular locking dependency detected 5.2.11-gentoo #2 Not tainted

[PATCH 5.3 080/112] firmware: google: increment VPD key_len properly

2019-10-16 Thread Greg Kroah-Hartman
From: Brian Norris [ Upstream commit 442f1e746e8187b9deb1590176f6b0ff19686b11 ] Commit 4b708b7b1a2c ("firmware: google: check if size is valid when decoding VPD data") adds length checks, but the new vpd_decode_entry() function botched the logic -- it adds the key length twice, instead of

[PATCH 5.3 101/112] media: stkwebcam: fix runtime PM after driver unbind

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit 30045f2174aab7fb4db7a9cf902d0aa6c75856a7 upstream. Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter") USB drivers must always balance their runtime PM gets and puts, including when the driver has already been unbound from

[PATCH 5.3 090/112] MIPS: Disable Loongson MMI instructions for kernel build

2019-10-16 Thread Greg Kroah-Hartman
From: Paul Burton commit 2f2b4fd674cadd8c6b40eb629e140a14db4068fd upstream. GCC 9.x automatically enables support for Loongson MMI instructions when using some -march= flags, and then errors out when -msoft-float is specified with: cc1: error: ‘-mloongson-mmi’ must be used with

[PATCH 5.3 088/112] btrfs: fix uninitialized ret in ref-verify

2019-10-16 Thread Greg Kroah-Hartman
From: Josef Bacik commit c5f4987e86f6692fdb12533ea1fc7a7bb98e555a upstream. Coverity caught a case where we could return with a uninitialized value in ret in process_leaf. This is actually pretty likely because we could very easily run into a block group item key and have a garbage value in

[PATCH 5.3 068/112] drm/i915: Perform GGTT restore much earlier during resume

2019-10-16 Thread Greg Kroah-Hartman
From: Chris Wilson commit 6c76a93c453643e11a1063906c7c39168dd8d163 upstream. As soon as we re-enable the various functions within the HW, they may go off and read data via a GGTT offset. Hence, if we have not yet restored the GGTT PTE before then, they may read and even *write* random locations

[PATCH 5.3 079/112] IB/core: Fix wrong iterating on ports

2019-10-16 Thread Greg Kroah-Hartman
From: Mohamad Heib commit 1cbe866cbcb53338de33cf67262e73f9315a9725 upstream. rdma_for_each_port is already incrementing the iterator's value it receives therefore, after the first iteration the iterator is increased by 2 which eventually causing wrong queries and possible traces. Fix the above

[PATCH 5.3 070/112] selinux: fix context string corruption in convert_context()

2019-10-16 Thread Greg Kroah-Hartman
From: Ondrej Mosnacek commit 2a5243937c700ffe6a28e6557a4562a9ab0a17a4 upstream. string_to_context_struct() may garble the context string, so we need to copy back the contents again from the old context struct to avoid storing the corrupted context. Since string_to_context_struct() tokenizes

[PATCH 5.3 052/112] iio: adc: hx711: fix bug in sampling of data

2019-10-16 Thread Greg Kroah-Hartman
From: Andreas Klinger commit 4043ecfb5fc4355a090111e14faf7945ff0fdbd5 upstream. Fix bug in sampling function hx711_cycle() when interrupt occures while PD_SCK is high. If PD_SCK is high for at least 60 us power down mode of the sensor is entered which in turn leads to a wrong measurement.

[PATCH 5.3 062/112] efivar/ssdt: Dont iterate over EFI vars if no SSDT override was specified

2019-10-16 Thread Greg Kroah-Hartman
From: Ard Biesheuvel commit c05f8f92b701576b615f30aac31fabdc0648649b upstream. The kernel command line option efivar_ssdt= allows the name to be specified of an EFI variable containing an ACPI SSDT table that should be loaded into memory by the OS, and treated as if it was provided by the

[PATCH 5.3 025/112] serial: uartps: Fix uartps_major handling

2019-10-16 Thread Greg Kroah-Hartman
From: Michal Simek commit 5e9bd2d70ae7c00a95a22994abf1eef728649e64 upstream. There are two parts which should be fixed. The first one is to assigned uartps_major at the end of probe() to avoid complicated logic when something fails. The second part is initialized uartps_major number to 0 when

[PATCH 5.3 087/112] btrfs: fix incorrect updating of log root tree

2019-10-16 Thread Greg Kroah-Hartman
From: Josef Bacik commit 4203e968947071586a98b5314fd7ffdea3b4f971 upstream. We've historically had reports of being unable to mount file systems because the tree log root couldn't be read. Usually this is the "parent transid failure", but could be any of the related errors, including "fsid

[PATCH 5.3 024/112] serial: uartlite: fix exit path null pointer

2019-10-16 Thread Greg Kroah-Hartman
From: Randy Dunlap commit a553add0846f355a28ed4e81134012e4a1e280c2 upstream. Call uart_unregister_driver() conditionally instead of unconditionally, only if it has been previously registered. This uses driver.state, just as the sh-sci.c driver does. Fixes this null pointer dereference in

[PATCH 5.3 044/112] mei: me: add comet point (lake) LP device ids

2019-10-16 Thread Greg Kroah-Hartman
From: Tomas Winkler commit 4d86dfd38285c83a6df01093b8547f742e3b2470 upstream. Add Comet Point devices IDs for Comet Lake U platforms. Cc: Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20191001235958.19979-1-tomas.wink...@intel.com Signed-off-by: Greg Kroah-Hartman ---

[PATCH 5.3 074/112] cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic

2019-10-16 Thread Greg Kroah-Hartman
From: Dave Wysochanski commit cb248819d209d113e45fed459773991518e8e80b upstream. Commit 487317c99477 ("cifs: add spinlock for the openFileList to cifsInodeInfo") added cifsInodeInfo->open_file_lock spin_lock to protect the openFileList, but missed a few places where cifs_inode->openFileList was

[PATCH 5.3 075/112] kernel/sysctl.c: do not override max_threads provided by userspace

2019-10-16 Thread Greg Kroah-Hartman
From: Michal Hocko commit b0f53dbc4bc4c371f38b14c391095a3bb8a0bb40 upstream. Partially revert 16db3d3f1170 ("kernel/sysctl.c: threads-max observe limits") because the patch is causing a regression to any workload which needs to override the auto-tuning of the limit provided by kernel.

[PATCH 5.3 109/112] x86/asm: Fix MWAITX C-state hint value

2019-10-16 Thread Greg Kroah-Hartman
From: Janakarajan Natarajan commit 454de1e7d970d6bc567686052329e4814842867c upstream. As per "AMD64 Architecture Programmer's Manual Volume 3: General-Purpose and System Instructions", MWAITX EAX[7:4]+1 specifies the optional hint of the optimized C-state. For C0 state, EAX[7:4] should be set

[PATCH 5.3 045/112] mei: avoid FW version request on Ibex Peak and earlier

2019-10-16 Thread Greg Kroah-Hartman
From: Alexander Usyskin commit f8204f0ddd62966a0e79c2804963a21e3540dd82 upstream. The fixed MKHI client on PCH 6 gen platforms does not support fw version retrieval. The error is not fatal, but it fills up the kernel logs and slows down the driver start. This patch disables requesting FW

[PATCH 5.3 105/112] ftrace: Get a reference counter for the trace_array on filter files

2019-10-16 Thread Greg Kroah-Hartman
From: Steven Rostedt (VMware) commit 9ef16693aff8137faa21d16ffe65bb9832d24d71 upstream. The ftrace set_ftrace_filter and set_ftrace_notrace files are specific for an instance now. They need to take a reference to the instance otherwise there could be a race between accessing the files and

[PATCH 5.3 043/112] USB: legousbtower: fix use-after-free on release

2019-10-16 Thread Greg Kroah-Hartman
From: Johan Hovold commit 726b55d0e22ca72c69c947af87785c830289ddbc upstream. The driver was accessing its struct usb_device in its release() callback without holding a reference. This would lead to a use-after-free whenever the device was disconnected while the character device was still open.

[PATCH 5.3 102/112] arm64/sve: Fix wrong free for task->thread.sve_state

2019-10-16 Thread Greg Kroah-Hartman
From: Masayoshi Mizuma commit 4585fc59c0e813188d6a4c5de1f6976fce461fc2 upstream. The system which has SVE feature crashed because of the memory pointed by task->thread.sve_state was destroyed by someone. That is because sve_state is freed while the forking the child process. The child process

[PATCH 5.3 036/112] usb: typec: tcpm: usb: typec: tcpm: Fix a signedness bug in tcpm_fw_get_caps()

2019-10-16 Thread Greg Kroah-Hartman
From: Dan Carpenter commit 7101949f36fc77b530b73e4c6bd0066a2740d75b upstream. The "port->typec_caps.data" and "port->typec_caps.type" variables are enums and in this context GCC will treat them as an unsigned int so they can never be less than zero. Fixes: ae8a2ca8a221 ("usb: typec: Group all

[PATCH 5.3 100/112] drm/msm: Use the correct dma_sync calls harder

2019-10-16 Thread Greg Kroah-Hartman
From: Rob Clark commit 9f614197c744002f9968e82c649fdf7fe778e1e7 upstream. Looks like the dma_sync calls don't do what we want on armv7 either. Fixes: Unable to handle kernel paging request at virtual address 50001000 pgd = (ptrval) [50001000] *pgd= Internal error: Oops: 805

[PATCH 5.3 099/112] drm/i915: Mark contents as dirty on a write fault

2019-10-16 Thread Greg Kroah-Hartman
From: Chris Wilson commit b925708f28c2b7a3a362d709bd7f77bc75c1daac upstream. Since dropping the set-to-gtt-domain in commit a679f58d0510 ("drm/i915: Flush pages on acquisition"), we no longer mark the contents as dirty on a write fault. This has the issue of us then not marking the pages as

[PATCH 5.3 096/112] Fix the locking in dcache_readdir() and friends

2019-10-16 Thread Greg Kroah-Hartman
From: Al Viro commit d4f4de5e5ef8efde85febb6876cd3c8ab1631999 upstream. There are two problems in dcache_readdir() - one is that lockless traversal of the list needs non-trivial cooperation of d_alloc() (at least a switch to list_add_rcu(), and probably more than just that) and another is that

[PATCH 5.3 098/112] drm/i915: Whitelist COMMON_SLICE_CHICKEN2

2019-10-16 Thread Greg Kroah-Hartman
From: Kenneth Graunke commit 282b7fd5f5ab4eba499e1162c1e2802c6d0bb82e upstream. This allows userspace to use "legacy" mode for push constants, where they are committed at 3DPRIMITIVE or flush time, rather than being committed at 3DSTATE_BINDING_TABLE_POINTERS_XS time. Gen6-8 and Gen11 both use

[PATCH 5.3 071/112] CIFS: Gracefully handle QueryInfo errors during open

2019-10-16 Thread Greg Kroah-Hartman
From: Pavel Shilovsky commit 30573a82fb179420b8aac30a3a3595aa96a93156 upstream. Currently if the client identifies problems when processing metadata returned in CREATE response, the open handle is being leaked. This causes multiple problems like a file missing a lease break by that client which

[PATCH 5.3 095/112] iio: light: fix vcnl4000 devicetree hooks

2019-10-16 Thread Greg Kroah-Hartman
From: Marco Felsch [ Upstream commit 1436a78c63495dd94c8d4f84a76d78d5317d481b ] Since commit ebd457d55911 ("iio: light: vcnl4000 add devicetree hooks") the of_match_table is supported but the data shouldn't be a string. Instead it shall be one of 'enum vcnl4000_device_ids'. Also the matching

[PATCH 5.3 093/112] ACPI/PPTT: Add support for ACPI 6.3 thread flag

2019-10-16 Thread Greg Kroah-Hartman
From: Jeremy Linton Commit bbd1b70639f785a970d998f35155c713f975e3ac upstream. ACPI 6.3 adds a flag to the CPU node to indicate whether the given PE is a thread. Add a function to return that information for a given linux logical CPU. Signed-off-by: Jeremy Linton Reviewed-by: Sudeep Holla

<    2   3   4   5   6   7   8   9   10   11   >